The vulnerability arises from incorrect ownership assignment in PostgreSQL's ALTER TABLE ALTER TYPE command. When this command is executed, ownership of dependent statistics objects is reassigned to the current user rather than preserving the original ownership. This misassignment allows the table owner to execute DROP STATISTICS and ALTER STATISTICS commands on these objects, which should normally be restricted to the original statistics object owner. Despite this, the DROP TABLE command can still remove statistics objects, which mitigates the potential impact in many ownership configurations. The issue affects PostgreSQL versions prior to 14.24, 15.19, 16.15, 17.11, and 18.5.

The vulnerability allows improper reassignment of ownership of statistics objects, enabling the table owner to run DROP STATISTICS and ALTER STATISTICS commands that should be restricted. This could lead to unauthorized modification or removal of statistics objects. However, since DROP TABLE can still remove statistics objects regardless of ownership, the exploit's practical impact is limited in many scenarios. There is no confidentiality or availability impact reported, and no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Users should monitor PostgreSQL vendor advisories for updates and apply patches when available. Until then, be aware of the ownership reassignment behavior when using ALTER TABLE ALTER TYPE and consider restricting privileges accordingly.